update: improve control and UX of ignored events

[jasondellaluce]

What type of PR is this?

/kind cleanup

/kind design

Any specific area of the project related to this PR?

/area engine

What this PR does / why we need it:

This PR segregates the logic behind the -i/-A ignored events in a single place. The set of ignored events is now set to be the one of the high-throughput I/O syscalls (that can be impactful for performance), but excluding those that are part of the base set of events required by libsinsp to collect its internal state.

Accordingly, this removes all mentions to the I/O syscalls set from the CLI helpers and comments. The fact that we chose that set as ignored should be an implementation detail that we don't leak as part of the tool's UX. This way, the output of -i is the only contract we have with users about which events are forcely ignored without -A, which is also easier to test too.

Which issue(s) this PR fixes:

Special notes for your reviewer:

This fixes an issue where Falco "ignores" some syscalls that were automatically added as part of the default base set, which ended up being written in the logs as ignored events even when not specified by users (e.g. recvfrom, sendto, ...).

cc @incertum, @Andreagit97, @FedeDP

Does this PR introduce a user-facing change?:

update: improve control and UX of ignored events

[jasondellaluce]

/milestone 0.35.0

[FedeDP]

/approve

[poiana]

LGTM label has been added.

Git tree hash: b503fbcb9a8a5bcd70161f1fc7a46cabd12d267a

[Andreagit97]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, jasondellaluce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,FedeDP,jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[incertum]

While we already merged it, just leaving a record LGTM as well. As we discussed many times I am still hesitant if our new default option (while improved) works well for many end users. The good news however is that we have base_syscalls which we might want to promote more going forward, especially for end users who have to be very careful with the performance impact associated with running Falco.